4 ms·

That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunt

by 3JPLW 13y ago

That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.

eli 13y ago
Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.
- shawabawa3 13y ago
  > Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil". i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black
  - meowface 13y ago
    You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code. Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.
- err4nt 13y ago
  I doubt it could have been called 'stealing' if he only accessed what was posted publicly by the authors themselves at the time. Until he contacted Prezi, how could he be certain beyond any doubt that they weren't already aware of it? Could you explain that to me?
  - davorak 13y ago
    Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.
    - dllthomas 13y ago
      As I read it, he didn't use the credentials to take the source code; he found the credentials in the source code. He used the credentials merely to verify the credentials were valid.
      - davorak 13y ago
        Ahh, at the time I thought err4nt was referring to the public posted login credentials and was making the analogy off of that.
    - csallen 13y ago
      Define "take" source code. Do you mean "read" or "access" source code? I know this is an aside, but I think we as a community need to be more judicious in our use of criminally-accusatory words, especially when it comes to taking/stealing/theft vs copying vs distributing/selling vs reading/watching/accessing. They're all very, very different things.
      - davorak 13y ago
        You read my post in the ~5 secs widow where it had the word "take." It was the wrong word because in the case I was talking about it would not have deprived Prezi access to their source code.
- 3JPLW 13y ago
  From Wikipedia, which agrees with my understanding of the phrase: "… such people sometimes act illegally, though in good will, to identify vulnerabilities in computing processes." My point, though, is that it's hardly out of scope when it's a valuable resource for developing novel attacks on in-scope domains. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat
- angersock 13y ago
  How exactly does one "steal" source code, if the original copy still remains with the authors?

by 3JPLW 13y ago

That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.

eli 13y ago

Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.

shawabawa3 13y ago
> Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil". i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black
- meowface 13y ago
  You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code. Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.
err4nt 13y ago
I doubt it could have been called 'stealing' if he only accessed what was posted publicly by the authors themselves at the time. Until he contacted Prezi, how could he be certain beyond any doubt that they weren't already aware of it? Could you explain that to me?
- davorak 13y ago
  Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.
  - dllthomas 13y ago
    As I read it, he didn't use the credentials to take the source code; he found the credentials in the source code. He used the credentials merely to verify the credentials were valid.
    - davorak 13y ago
      Ahh, at the time I thought err4nt was referring to the public posted login credentials and was making the analogy off of that.
  - csallen 13y ago
    Define "take" source code. Do you mean "read" or "access" source code? I know this is an aside, but I think we as a community need to be more judicious in our use of criminally-accusatory words, especially when it comes to taking/stealing/theft vs copying vs distributing/selling vs reading/watching/accessing. They're all very, very different things.
    - davorak 13y ago
      You read my post in the ~5 secs widow where it had the word "take." It was the wrong word because in the case I was talking about it would not have deprived Prezi access to their source code.
3JPLW 13y ago
From Wikipedia, which agrees with my understanding of the phrase: "… such people sometimes act illegally, though in good will, to identify vulnerabilities in computing processes." My point, though, is that it's hardly out of scope when it's a valuable resource for developing novel attacks on in-scope domains. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat
angersock 13y ago
How exactly does one "steal" source code, if the original copy still remains with the authors?